secfire Goto Github PK

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

apolloscanner

自动化巡航扫描框架（可用于红队打点评估）

apt_report

Interesting apt report collection and some special ioc express

ares

Python botnet and backdoor

awesome-red-teaming

List of Awesome Red Teaming Resources

binary-encryption

Original code about binary encryption from phrack

coffloader2

Load and execute COFF files and Cobalt Strike BOFs in-memory

darkloadlibrary

LoadLibrary for offensive operations

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

elfload

An ELF loader for embedded systems.

grassmarlin

Provides situational awareness of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks in support of network security assessments. #nsacyber

infinityhook

Hook system calls, context switches, page faults and more.

kekeo

A little toolbox to play with Microsoft Kerberos in C

libelfmaster

Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools

libevent

Event notification library

libpeconv

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_project_template

nsa-data

NSA documents in machine readable form

obfusion

Obfusion - C++ X86 Code Obfuscation Library

openark

OpenArk is a open source anti-rookit tool on Windows.

openbilibili

pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

pe2shellcode

Convert PE files to a shellcode

pe_to_shellcode

Converts PE into a shellcode

peacemaker

PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.

potato

Windows privilege escalation through NTLM Relay and NBNS Spoofing

powershdll

Run PowerShell with rundll32. Bypass software restrictions.

r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments

sherlocked

Universal script packer-- transforms any type of script into a protected ELF executable, encrypted with anti-debugging.

silentmoonwalk

PoC Implementation of a fully dynamic call stack spoofer